EU Cyber Resilience Act Reporting Obligations Begin September 11: Who Must Report, How Fast

On September 11, 2026, the reporting obligations under the EU's Cyber Resilience Act (Regulation (EU) 2024/2847) took effect: the European Union Agency for Cybersecurity (ENISA) simultaneously launched its Single Reporting Platform (SRP), letting manufacturers report actively exploited vulnerabilities and severe incidents under Article 14. The Regulation itself splits ‘application’ into three dates, and September 11 is only one of them.

This article was fact-checked on September 17, 2026, drawing on the European Commission's reporting-obligations page, ENISA's launch press release and FAQ, and the Regulation's full text as published in the Official Journal of the European Union. This site has not actually submitted a notification or tested the platform itself; the following does not compare vendors or advise on whether to upgrade a device, and only summarizes the officially published provisions and deadlines.

The Three Dates in Article 71(2): September 11 Is Only Article 14's Turn

Article 71(2) of the Cyber Resilience Act splits ‘application’ into three dates: the Regulation applies in full from December 11, 2027 in principle; Article 14 (manufacturers' reporting obligations) applies earlier, from September 11, 2026; and Chapter IV (Articles 35 to 51, on the notification of conformity assessment bodies) applies earlier still, from June 11, 2026.

Only Article 14 takes effect on September 11, 2026. The European Commission's page states it plainly: manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security from September 11 onward; open-source software stewards take on the same obligation under Article 24(3), but only to the extent they are involved in developing the product, and under Article 71(2) their obligation does not begin until December 11, 2027 — ENISA's FAQ likewise keeps the two starting dates separate.

The Regulation was signed in Strasbourg on October 23, 2024, and published in the Official Journal of the European Union on November 20 of the same year; under the formula in Article 71(1), it entered into force on the twentieth day after publication. ‘Entering into force’ and ‘what the provisions require you to do’ are two different things — every sentence that follows in this article notes whether it is already in effect on September 11 or waits until December 11, 2027.

How Fast a Notification Must Go Out, Once You Know

The clock starts running when the manufacturer becomes aware, not from the moment the vulnerability or incident actually occurs. ENISA's FAQ is explicit: the reporting process starts when a manufacturer — or, once it applies, an open-source software steward — becomes aware of it. Article 3(42) defines an ‘actively exploited vulnerability’ as one for which there is reliable evidence that a malicious actor has exploited it without the system owner's permission — merely knowing a weakness exists does not, on its own, trigger the notification obligation under Article 14(1).

Actively exploited vulnerabilities and severe incidents share the same early-warning and full-notification deadlines, but the formula for the final report differs. Under Article 14(2): without undue delay, and in any case within 24 hours of becoming aware, the manufacturer sends an early warning; within 72 hours, a full notification; and the final report follows within 14 days after a corrective or mitigating measure becomes available. Under Article 14(4), the final report for a severe incident instead falls due within one month after the 72-hour notification itself is submitted — the clock there starts from the notification, not from the moment of awareness, and the 14-day rule does not apply.

Article 14(6) gives the CSIRT one more power: if the CSIRT that received the notification considers it necessary, it may ask the manufacturer for an intermediate report describing a status update — a possible fifth document alongside the early warning, the full notification, and the final report. The European Commission's reporting page condenses these four deadlines into a single sentence.

Where a Notification Goes: One Window, Copied to ENISA

A notification is submitted through the Single Reporting Platform only once. Under Article 14(7), the manufacturer submits it through the electronic notification end-point of the CSIRT designated as coordinator for the Member State of its main establishment in the EU, made simultaneously accessible to ENISA; the Commission notes this holds except in particularly exceptional circumstances. ‘Main establishment’ looks first at the Member State where decisions about product security are made; where that cannot be determined, it looks instead at the Member State with the most employees.

For a manufacturer with no main establishment in the EU, Article 14(7) has it work through one of four fallback identities in order: the Member State of the authorised representative handling the largest number of its products, the Member State of the importer placing the largest number of its products on the market, the Member State of the distributor supplying the largest number of its products, or the Member State with the most users. ENISA warns that the consequence of picking the wrong window is not minor: the notification may be invalidated and have to be resubmitted to the correct one.

The CSIRT that receives a notification forwards it to the CSIRTs of the other Member States where the product is on the market, and supplies market surveillance authorities with the information they need — that is the substance of Article 16. Article 71(2)'s list of provisions that apply early covers only Article 14 and Chapter IV; Article 16 is not on it. Even so, both the Commission and ENISA state that the platform was built under Article 16 and has been operating since September 11. In exceptional cases the CSIRT may delay forwarding; the Commission notes that a delegated act adopted on December 11, 2025 sets out the conditions for that delay.

What This Means for Users and Devices Already Sold

Devices already sold are not exempt. ENISA's FAQ states that the Article 14 reporting obligation ‘will apply from 11 September 2026 to all products with digital elements falling within the scope of the CRA, including products that were placed on the market before 11 December 2027.’ For a router, camera, or wearable bought a few years ago — as long as it is sold on the EU market — the manufacturer must report now if it faces an actively exploited vulnerability or a severe incident, without waiting for the Regulation's full application in December 2027.

Article 14(8) requires the manufacturer, once it becomes aware, to inform affected users of the vulnerability or incident, together with any risk-mitigation and corrective measures where necessary, in a structured, machine-readable format where appropriate. The official pages this article consulted set no deadline, language, or channel for that notice. A likely point of confusion: the reporting obligation does not mean ‘a device will get a patch faster’ — that falls under Article 13's maintenance-period rules, which likewise do not apply until December 11, 2027, and the official pages this article consulted do not say that the reporting obligation taking effect will speed up patches.

A reported vulnerability is not automatically made public: under Article 17(5), ENISA adds a publicly known vulnerability to the European vulnerability database (EUVD) only once a corrective or mitigating measure is available and the manufacturer agrees. As for penalties, Article 64 sets a ceiling of up to €15 million, or 2.5% of an offending undertaking's total worldwide annual turnover for the preceding financial year, whichever is higher, for breaches of Articles 13, 14, and the security requirements in Annex I — with the actual rules set by each Member State and notified to the Commission. Article 64 is not among the provisions Article 71(2) lists as applying early; none of the three official pages this article consulted mentions fines, or says whether, between now and December 2027, a breach of Article 14 would be penalized.

How Far the Platform Has Gotten So Far

ENISA describes the platform that just launched as an ‘initial operating capability,’ not a finished product. Its FAQ lists what is still missing: at launch the interface supports English only; there is no application programming interface, so notifications must be submitted through the platform's own interface; and voluntary reporting under Article 15 — covering vulnerabilities, threats, incidents, and near-misses — is not yet available, so the platform currently accepts only the mandatory notifications required under Article 14. ENISA says voluntary reporting will be introduced in a ‘future phase’; for the application programming interface and additional language versions, it says only that they may be considered, or will be reviewed, in the next phase — neither comes with a timetable.

The platform is also not a channel for consumer complaints: the current release accepts only the mandatory notifications manufacturers submit under Article 14, and a submission from someone who is not a manufacturer may be marked invalid. ENISA also openly acknowledges a known flaw: the 72-hour countdown timer actually shows a due time 48 hours after the 24-hour early warning is submitted, so in some cases a notification shows as overdue before 72 hours have actually elapsed since the manufacturer became aware; ENISA stresses that the timer's display does not replace the legal obligation itself.

There are also identity limits on who may submit a notification: each manufacturer may have only one ‘Primary’ designated representative (Primary AR) and up to 20 ‘Secondary’ designated representatives (Secondary ARs), who must log in with an EU Login account protected by multi-factor authentication — the platform currently has no additional corporate-identity verification mechanism. The Primary and Secondary representatives of the same manufacturer can all see that manufacturer's notifications, regardless of who originally submitted them; only unsubmitted drafts stay in each representative's own account. The official pages this article consulted do not disclose how many notifications, or how many registered manufacturers, the platform has had since launch, so this article does not state either figure.

2026 Tech News Roundup: Key Points on Hardware, Platforms, Telecom, and Regulation

Apple Announces New EU App Business Terms: A 5% Core Technology Commission, and Alternative Payments Alongside Apple In-App Purchase

• Tech & industry
• Tech news